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Amendments to the Claims 
This listing of claims will replace all prior versions of claims in the application: 
Listing of Claims: 

1 . (Previously presented) A computer implemented method of determining the location of 
an Internet host using a computer system, comprising the following computer executable acts: 

obtaining route information relating to a network path between a host IP address 
associated with the Internet host and the computer system, wherein the network path comprises 
the computer system, the Internet host, and at least one intermediate network node, and wherein 
the route information comprises a plurality of router labels associated with the host IP address 
and the at least one intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Internet host; 

providing a location estimate of the location of the Internet host according to the location 
information from the data store corresponding to the location code; 

determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along the network path; and 

selectively correcting the location estimate according to the delay time associated with 
the network path. 

2. (Previously presented) The method of claim 1, further comprising extracting the location 
code by examining the router labels in route order along the path from the host to the computer 
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system until a location code is found that is usable to obtain location information from the data 
store. 

3. (Previously presented) The method of claim 2, further comprising: 

determining a confidence metric representative of the accuracy of the location estimate; 

and 

selectively providing the location estimate of the location of the Internet host if the 
confidence metric exceeds a threshold. 

4. (Previously presented) The method of claim 3„ further comprising: 

detennining a confidence metric representative of the accuracy of the location estimate 
based upon the delay time between the Internet host and the network node associated with the 
location estimate. 

5. (Previously presented) The method of claim 1, further comprising: 

obtaining route information relating to each network path between the host IP address 
and each of a plurality of computer systems, wherein the route information comprises a plurality 
of router labels associated with the host IP address, and each of the plurality of computer 
systems, and at least one intermediate network node in each network path; 

extracting a locatiou code for each network path from the route information 
corresponding to a router label associated with one of the Internet host and the at least one 
intermediate network node in each network path; 

obtaining location information from the data store corresponding to each location code; 

providing a plurality of location estimates of the location of the Internet host according to 
the location information from the data store corresponding to each location code; and 

correlating at least two of the location estimates to provide an improved location estimate 
of the location of the Internet host. 

6. (Original) The method of claim 1, wherein the location code comprises one of a city 
code, and airport code, and a country code, and wherein obtaining the route information 
comprises using a traceroute too). 
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7. (Previously presented) A software tool for determining the location of an Internet host 
using a computer system, comprising the following computer executable components: 

a route trace component adapted to obtain route information relating to a network path 
between a host IP address associated with the Internet host and the computer system, wherein the 
first network path comprises the computer system, the Internet host, and at least one intermediate 
network node, and wherein the route information comprises a plurality of router labels associated 
with the host IP address and the at least one intermediate network node; 

an extraction component adapted to extract a location code from the route information 
corresponding to a router label associated with one of the Internet host and an intermediate 
network node proximate the Internet host; 

a data store comprising at least one data set having location codes and corresponding 
location information; 

an estimation component adapted to obtain location information from the data store 
corresponding to the location code associated with the one of the Internet host and the 
intermediate network node proximate the Internet host, and to provide a location estimate of the 
location of the Internet host according to the location information from the data store 
corresponding to the location code;. 

a correction component to determine a delay time associated with a transmission from the 
computer system to receipt of the transmission at the Internet host along the network path and 
selectively correct the location estimate according to the delay time associated with the network 
path. 

8. (Previously presented) A computer-readable medium having computer-executable 
instructions for: 

obtaining route information relating to a network path between a host IP address 
associated with an Internet host and a computer system, wherein the network path comprises the 
computer system, the Internet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
the at least one intermediate network node; 
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extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Internet host; 

providing a location estimate of the location of the Internet host according to the location 
information from the data store corresponding to the location code; 

detennining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along the network path; and 

selectively correcting the location estimate according to the delay time associated with 
the network path. 

9. (Previously presented) A computer implemented system for detennining the location of 
an Internet host, comprising the following computer executable components: 

a first component operating in a computer system to obtain route information relating to a 
network path between a host IP address associated with the Internet host and the computer 
system, wherein the first network path comprises the computer system, the Internet host, and at 
least one intermediate network node, and wherein the route information comprises a plurality of 
router labels associated with the host IP address and the at least one intermediate network node; 

a second component operating in the computer system to extract a location code from the 
route information corresponding to a router label associated with one of the Internet host and an 
intermediate network node proximate the Internet host; 

a third component operating in the computer system to consult a data store comprising at 
least one data set having location codes and corresponding location information; 

a fourth component operating in the computer system to obtain location information from 
the data store corresponding to the location code associated with the one of the Internet host and 
the intermediate network node proximate the Internet host; 
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a fifth component operating in the computer system to provide a location estimate of the 
location of the Internet host according to the location information from the data store 
corresponding to the location code; and 

a sixth component operating in the computer system to determine a delay time associated 
with a transmission from the computer system to receipt of the transmission at the Internet host 
along the network path and selectively correct the location estimate according to the delay time 
associated with the network path. 

10. (Previously presented) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system, comprising the 
following computer executable acts: 

obtaining route information relating to a network path between a host IP address 
associated with the Internet host and a computer system, wherein the network path comprises the 
computer system, the Internet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
the at least one intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Internet host; and 

providing a location estimate of the location of the Internet host according to the location 
information from the data store corresponding to the location code; 

determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along the network path; and 

selectively correcting the location estimate according to the delay time associated with 
the network path. 
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1 1 . (Previ ously presented) A computer implemented method of determining the location of 
an Internet host using multiple computer systems, comprising the following computer executable 
acts: 

obtaining route information relating to a plurality of network paths between a host IP 
address associated with the Internet host and a corresponding plurality of computer systems, 
respectively, wherein the plurality of network paths individually comprise a corresponding 
computer system, the Internet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
an intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intennediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Internet host; 

providing a location estimate of the location of the Internet host according to the location 
information. 

determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Internet host along at least one of the network paths; and 
selectively correcting the location estimate according to the delay time. 

12. (Previously presented) A computer implemented method of determining the location of 
an Internet host using a first computer system, comprising the following computer executable 
acts: 

measuring a first delay time relating to a transmission from the first computer system to 
receipt of the transmission at the Internet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 
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measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and the second computer system; 

measuring a third delay time relating to a transmission from a third computer system to 
receipt of the transmission at the Internet host along a third network path between the host IP 
address and the third computer system, at least one of the first, second, and third network paths 
containing at least one intermediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

13. (Original) The method of claim 12, wherein correlating the first, second, and third delay 
times comprises triangulating the first, second, and third delay measurements. 

14. (Original) The method of claim 1 2, wherein correlating the first, second, and third delay 
times comprises: 

consulting a data store comprising N sets of first, second, and third delay measurements 
between the first, second, and third computer systems, respectively, and N known hosts, as well 
as location information associated with the N known hosts, wherein N is an integer, 

performing a comparison of the first, second, and third delay times with the N sets of 
first, second, and third delay measurements in the data store; 

determining a nearest set of first, second, and third delay measurements according to the 
comparison; and 

providing a location estimate of tbe Internet host according to the nearest set of first, 
second, and third delay measurements. 

1 5. (Original) The method of claim 14, wherein performing the comparison of the first, 
second, and third delay times with the N sets of first, second, and third delay measurements in 
the data store comprises determining N Euclidian distances corresponding to the Euclidian 
distances between the N sets of first, second, and third delay measurements in the data store and 
the first, second, and third delay times, and wherein providing a location estimate of the Internet 
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host according to the nearest set of first, second, and third delay measurements comprises 
selecting location information associated with the set of first, second, and third delay 
measurements in the data store associated with the smallest Euclidian distance as the location 
estimate. 

1 6. (Original) The method of claim 1 2, 

wherein correlating the first, second, and third delay times comprises: 

computing a first probability density function establishing a relationship between a first 

network delay associated with the first computer system and a first distance from the first 

computer system; 

determining a first distance estimate representative of the distance between the first 
computer system and the location of the Internet host using the first delay time and the first 
probability density function; 

computing a second probability density function establishing a relationship between a 
second network delay associated with the second computer system and a second distance from 
the second computer system; 

determining a second distance estimate representative of the distance between the second 
computer system and the location of the Internet host using the second delay time and the second 
probability density function; 

computing a third probability density function establishing a relationship between a third 
network delay associated with the third computer system and a third distance from the third 
computer system; and 

determining a third distance estimate representative of the distance between the third 
computer system and the location of the Internet host using the third delay time and the third 
probability density function; 

and wherein providing the location estimate comprises triangulating the first, second, and 
third distance estimates. 

17. (Original) The method of claim 16, wherein determining the first, second, and third 
distance estimates further comprises computing an error function over a location space, and 
determining coordinates within the location space where the error function is minimized. 
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18- (Original) The method of claim 17, wherein determining coordinates within the location 
space where the error function is minimized comprises minimizing the error function across a list 
of known city locations, and wherein providing the location estimate comprises providing the 
known city location corresponding with the minimum value of the error function. 

1 9. (Original) The method of claim 1 8, wherein computing the error function comprises 
using a weighted least mean squares algorithm to optimize the location estimate. 

20 . (Original) The method of claim 1 8, wherein computing the error function comprises 
using a probability density estimation to optimize the location estimate. 

21 . (Original) The method of claim 1 8, wherein computing the error function comprises 
using a weighted least mean squares algorithm to prune a solution space, and using a probability 
density estimation to optimize the location estimate from the pruned solution space. 

22. (Original) The method of claim i 8, wherein computing the error function comprises 
using a probability density estimation to prune a solution space, and using a weighted least mean 
squares algorithm to optimize the location estimate from the pruned solution space. 

23. (Previously presented) A software tool for determining the location of an Internet host 
using a first computer system, comprising the following computer executable components: 

a first delay component adapted to measure a first delay time relating to a transmission 
from the first computer system to receipt of the transmission at the Internet host along a first 
network path between a host IP address associated with the Internet host and the first computer 
system; 

a second delay component adapted to measure a second delay time relating to a 
transmission from a second computer system to receipt of the transmission at the Internet host 
along a second network path between the host BP address and the second computer system; 

a third delay component adapted to measure a third delay time relating to a transmission 
from a third computer system to receipt of the transmission at the Internet host along a third 
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network path between the host IP address and the third computer system, at least one of the first, 
second, and third network paths containing at least one intermediate node; 

a coxrelation component adapted to correlate the first, second, and third delay times; and 
an estimation component adapted to provide a location estimate of the location of the 
Internet host according to the correlation of the first, second, and third delay times. 

24. (Previously presented) A computer-readable medium having computer-executable 
instructions for: 

measuring a first delay time relating to a transmission from a first computer system to 
receipt of the transmission at an Internet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 

measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and the second computer system; 

measuring a third delay time relating to a transmission from the Internet host to receipt of 
the transmission at a third computer system along a third network path between the host IP 
address associated with the Internet host and a third computer system, at least one of the first, 
second, and third network paths containing at least one intermediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

25. (Previously presented) A computer implemented system for determining the location of 
an Internet host, comprising the following computer executable components: 

a first component operating in a first computer system to measure a first delay time 
relating to a transmission from the first computer system to receipt of the transmission at the 
Internet host along a first network path between a host EP address associated with the Internet 
host and the first computer system; 

a second component operating to measure a second delay time relating to a transmission 
from a second computer system to receipt of the transmission at the Internet host along a second 
network path between the host IP address and the second computer system; 

11 

PAGE 11f20 1 RCVD AT 3110/2006 3:08:11 PM [Eastern Standard Time]* SVR:USTO-ffXRF-3/l8 1 DN1S:2738300 * CS1D:216 696 8731 * DURATION (mm-ss):06-38 



03/10/2006 15:04 FA1 216 696 8731 

09/849,662 



AMIN, & TUROCY LLP. @]012 

MS164164.02/MSFTP189USA 



a third component operating to measure a third delay time relating to a transmission from 
a third computer system to receipt of the transmission at the Internet host along a third network 
path between the host IP address and the third computer system, at least one of the first, second, 
and third network paths containing at least one intermediate node; 

a fourth component operating to correlate the first, second, and third delay times; and 
a fifth component operating in a first computer system to provide a location estimate of 
the location of the Internet host according to the correlation of the first, second, and third delay 
times. 

26. (Previously presented) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system, comprising the 
following computer executable acts: 

measuring a first delay time relating to a transmission from a first computer system to 
receipt of the transmission at the Internet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 

measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and the second computer system; 

measuring a third delay time relating to a transmission from a third computer system to 
receipt of the transmission at the Internet host along a third network path between the host IP 
address and the third computer system, at least one of the first, second, and third network paths 
containing at least one intermediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

27. (Previously presented) A method of determining the location of an Internet host using a 
first computer system, comprising the following computer executable acts: 

obtaining partial IP-to-location mapping information from a data source; 
obtaining network routing information; 
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clustering together IP addresses corresponding to hosts in the same geographic location 
according to network renting information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster information; and 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host 

28. (Original) The method of claim 27, wherein obtaining network routing information 
comprises using a routing protocol. 

29. (Original) The method of claim 28, wherein the routing protocol is one of BGP, RIP, 
OSPF,IGRP,andEGP. 

30. (Original) The method of claim 27, wherein clustering together IP addresses 
corresponding to hosts in the same geographic location according to network routing information 
to obtain cluster information comprises associating an address prefix used by a routing protocol 
with a geographical location. 

3 1 . (Original) The method of claim 30, further comprising: 

sub-dividing the geographical location associated with the address prefix into at least two 
clusters according to a geographical spread associated with the geographical location. 

32. (Original) The method of claim 27, further comprising sub-dividing the cluster 
information according to a geographical spread associated with the geographical location. 

33. (Previously presented) The method of claim 27, further comprising selectively providing 
the location estimate if the dispersion metric is less than a threshold value. 

34. (Previously presented) The method of claim 33, further comprising a threshold value that 
is dependent on the size of the cluster. 
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35. (Original) The method of claim 27, further comprising: 

obtaining route information relating to a first network path between a host IP address 
associated with the Internet host and the first computer system, wherein the first network path 
comprises the first computer system, the Internet host, and at least one intermediate network 
node, and wherein the route information comprises a plurality of router labels associated with the 
host IP address and the at least one intermediate network node; 

extracting a first location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining first location information from the data store corresponding to the first location 
code associated with the one of the Internet host and the intermediate network node proximate 
the Internet host; and 

providing a first location estimate of the location of the Internet host according to the first 
location information from the data store corresponding to the first location code. 

36. (Previously presented) The method of claim 35, further comprising; 

measuring a first delay time relating to a transmission from the first computer system to 
receipt of the transmission at the Internet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 

measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and the second computer system; 

measuring a third delay time relating to a transmission from a third computer system to 
receipt of the transmission at the Internet host along a third network path between the host IP 
address and the third computer system, at least one of the first, second, and third network paths 
containing at least one intermediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 
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37. (Previously presented) The method of claim 27, further comprising: 

measuring a first delay time relating to a transmission from the first computer system to 
receipt of the transmission at the Internet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 

measuring a second delay time relating to a transmission from a secondcomputer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and the second computer system; 

measuring a third delay time relating to a transmission from a third computer system to 
receipt of the transmission at the Internet host along a third network path between the host IP 
address and the third computer system, at least one of the first, second, and third network paths 
containing at least one inteimediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

3 8 . (Previously presented) A software tool for determining the location of an Internet host 
using a first computer system, comprising the following computer executable components: 

a first component adapted to obtain partial IP-to-location mapping information from a 
data source; 

a routing protocol component adapted to obtain network routing information; 

a clustering component adapted to cluster together IP addresses corresponding to hosts in 
the same geographic location according to network routing information to obtain cluster 
information; 

a correlation component adapted to correlate the partial IP-to-location information with 
the cluster information; 

an estimation component adapted to provide a location estimate of the location of the 
Internet host according to the correlation of the partial IP-to-location information and the cluster 
information; and 

a correction component to compute a dispersion metric representative of the accuracy of 
the location estimate of the location of the Internet host and selectively providing the location 
estimate. 
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39. (Previously presented) A computer-readable medium having computer-executable 
instructions for: 

obtaining partial IP-to-location mapping information from a data source; 
obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information; 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster information; and 

calculating a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host and selectively providing the location estimate. 

40. (Previously presented) A computer implemented system for determining the location of 
an Internet host, comprising the following computer executable components: 

a first component operating to obtain partial IP-to-location mapping information from a 
data source; 

a second component operating to obtain network routing information; 

a third component operating to cluster together IP addresses corresponding to hosts in the 
same geographic location according to network routing information to obtain cluster 
infonnation; 

a fourth component operating to correlate the partial IP-to-location information with the 
cluster information; 

a fifth component operating to provide a location estimate of the location of the Internet 
host according to the correlation of the partial IP-to-location infonnation and the cluster 
information; and 

a sixth component operating to calculate a dispersion metric representative of the 
accuracy of the location estimate of the location of the Internet host and selectively providing the 
location estimate. 
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41 . (Previously presented) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system, comprising the 
following computer executable acts: 

obtaining partial iP-to-location mapping information from a data source; 

obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information; 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster information; and 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host and selectively providing the location estimate. 
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